Panchayat Office in Kerala's Wayanad District Hit by 'WannaCry' Ransomware

Wayanad: The worldwide cyberattack of WannaCry ransomware affected four computers in a panchayat office in Thariyode of Wayanad district.

“On Friday evening, the officers present felt there was some virus as the systems were getting slow. Since it was time to leave, the officers shut down the system and thought they would check it on Monday. Today when they came to office, they saw the message. The systems have details related to property tax and panchayat accounts,” said a panchayat office official.

Nodal officer of Kerala Police Cyberdome, IG Manoj Abraham said, “Looking at the message we think it is a ransomware attack. We have sent our team to confirm the same. The four computers were networked, so they are already affected."

"Cyber experts have been engaged to fix the systems," a senior police officer said.

The red-coloured 'critical alert' was issued by the Computer Emergency Response Team of India (CERT-In), the nodal agency to combat hacking, phishing and to fortify security-related defences of the Indian Internet domain.

This exploit is named as ETERNALBLUE," an advisory issued by the CERT-In, accessed by PTI, said.

It said the ransomware called 'WannaCry' or 'WannaCrypt' encrypts the computer's hard disk drive and then spreads laterally between computers on the same local area network (LAN).

"The ransomware also spreads through malicious attachments to emails," it said.

Following the alert, the Gujarat government began equipping its state computer systems with anti-virus softwares and upgrading its Microsoft operating systems.

The cyber sleuths agency advised users to apply patches to their Windows systems in order to prevent its infection and spread.

'WannaCry' encrypts files with the following extensions, appending. WCRY to the end of the file name like .lay6, .sqlite3, .sqlitedb, .accdb, .java and .docx among others.

In cases of genuine (universal resource locators) URLs, close out the email and go to the organisation's website directly through browser," it said.

The most important advisory by the CERT-In stated "individuals or organisations are not encouraged to pay the ransom as this does not guarantee files will be released.